H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS Routers - CLI
1. CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
http://www.howtonetwork.net
CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS Routers - CLI
Lab 9
Enabling SSH and HTTPS access to Cisco IOS Routers
Lab Objective:
The objective of this lab exercise is for you to learn and understand how enable
SSH and HTTPS access to Cisco IOS routers.
Lab Purpose:
SSH and HTTPS are secure management protocols that are recommended for remotely
accessing and managing Cisco IOS devices. It is imperative to understand the
configuration tasks required to enable SSH access in the Cisco IOS software
suite.
Lab Difficulty:
This lab has a difficulty rating of 5/10.
Readiness Assessment:
When you are ready for your certification exam, you should complete this lab in
no more than 10 minutes.
Lab Topology:
Please use the following topology to complete this lab:
NOTE:
If you do not have a Host in your lab, you can simply substitute Host 1 for another router with an Ethernet interface and
a default static route pointing to 172.16.1.2.
Lab 9 Configuration Tasks
Task 1:
Configure the hostname on R2 and IP addressing as illustrated in the diagram. In addition, configure Host 1 with the IP
address specified and a default gateway of 172.16.1.2. Verify that Host 1 can ping R2 successfully.
Task 2:
Configure R2 with the domain name howtonetwork.net. In addition to this, configure R2 so that is generates a 2048-bit
RSA key for maximum security.
Task 3:
Enable HTTPS support on R2. Ensure that only the 172.16.1.0/24 subnet can access the router via HTTPS. All attempts
from any other subnet should be logged. In addition to this, configure R2 to only allow SSH connections without using an
ACL.
Task 4:
Configure a username of ccna with a password of security on R2. This user should have Level 15 access to the router. In
1 of 9 02/06/2011 8:18 SA
2. CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
addition, R2 should authenticate all HTTPS and SSH sessions using the local router database.
Task 5:
Verify your configuration by accessing R2 via HTTPS and SSH.
Lab 9 Configuration and Verification
Task 1:
Router(config)#hostname R2
R2(config)#interface fastethernet0/0
R2(config-if)#ip address 172.16.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#exit
R2#
Task 2:
R2(config)#ip domain-name howtonetwork.net
R2(config)#crypto key generate rsa
The name for the keys will be: R2.howtonetwork.net
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
R2(config)#exit
R2#
R2#show crypto key mypubkey rsa
2 of 9 02/06/2011 8:18 SA
4. CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
R2(config)#ip http secure-server
R2(config)#ip http access-class 10
R2(config)#line vty 0 4
R2(config-line)#transport input ssh
R2(config-line)#exit
R2(config)#exit
R2#
Task 4:
R2(config)#username ccna privilege 15 secret security
R2(config)#ip http authentication local
R2(config)#line vty 0 4
R2(config-line)#login local
R2(config-line)#exit
R2(config)#exit
R2#
Task 5:
To verify SSH, you need an SSH client, such as Putty — for example:
4 of 9 02/06/2011 8:18 SA
5. CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
To verify HTTPS access, all you need is a simple Web Browser:
5 of 9 02/06/2011 8:18 SA
6. CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
Lab 9 Configurations
R2 Configuration
R2#show run
Building configuration...
Current configuration : 2666 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
no logging console
!
no aaa new-model
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
6 of 9 02/06/2011 8:18 SA
8. CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
username ccna privilege 15 secret 5 $1$AMJ7$Jhs/IcLaJsecnzlaKZCl91
archive
log config
hidekeys
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 172.16.1.2 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0
no ip address
!
ip forward-protocol nd
!
!
ip http server
ip http access-class 10
ip http authentication local
ip http secure-server
!
access-list 10 remark "This is my HTTPS ACL"
access-list 10 permit 172.16.1.0 0.0.0.255
access-list 10 deny any log
!
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
8 of 9 02/06/2011 8:18 SA
![CCNA Security Lab 9 - Enabling SSH and HTTPS access to Cisco IOS... http://www.howtonetwork.net/public/1251print.cfm
addition, R2 should authenticate all HTTPS and SSH sessions using the local router database.
Task 5:
Verify your configuration by accessing R2 via HTTPS and SSH.
Lab 9 Configuration and Verification
Task 1:
Router(config)#hostname R2
R2(config)#interface fastethernet0/0
R2(config-if)#ip address 172.16.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#exit
R2#
Task 2:
R2(config)#ip domain-name howtonetwork.net
R2(config)#crypto key generate rsa
The name for the keys will be: R2.howtonetwork.net
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
R2(config)#exit
R2#
R2#show crypto key mypubkey rsa
2 of 9 02/06/2011 8:18 SA](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)